raccoon | 936cbd7a8071272045f11265e258264cf6638791d133352399860024c763fd8d

Analysis

max time kernel
20s
max time network
68s
platform
windows10_x64
resource
win10v20201028
submitted
24/12/2020, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2c8316535580b835c1501608a0c54d27.exe
Size 511KB
Sample201224-n6pf4a7366
SHA256 936cbd7a8071272045f11265e258264cf6638791d133352399860024c763fd8d
MD5 2c8316535580b835c1501608a0c54d27
SHA1 db2147ac65e44f7ac4461a45e319bcbede9209b6
SHA512 fec89b31f5fbf18baa1afcba19e4d450ab6fb199fdbf1ed028ce230dc23e390a8c3b48550a60db05aa8e37f30e83c7dfe7fcf86d5db95d9a62993f737200af28
MD5 SHA1 SHA512

Score

10^/10

raccoon discovery spyware stealer

Malware Config

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Loads dropped DLL 8 IoCs

pid	Process
648	2c8316535580b835c1501608a0c54d27.exe
648	2c8316535580b835c1501608a0c54d27.exe
648	2c8316535580b835c1501608a0c54d27.exe
648	2c8316535580b835c1501608a0c54d27.exe
648	2c8316535580b835c1501608a0c54d27.exe
648	2c8316535580b835c1501608a0c54d27.exe
648	2c8316535580b835c1501608a0c54d27.exe
648	2c8316535580b835c1501608a0c54d27.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ab81-5.dat	js

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3412	timeout.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 1908	648	2c8316535580b835c1501608a0c54d27.exe	77
PID 648 wrote to memory of 1908	648	2c8316535580b835c1501608a0c54d27.exe	77
PID 648 wrote to memory of 1908	648	2c8316535580b835c1501608a0c54d27.exe	77
PID 1908 wrote to memory of 3412	1908	cmd.exe	79
PID 1908 wrote to memory of 3412	1908	cmd.exe	79
PID 1908 wrote to memory of 3412	1908	cmd.exe	79

C:\Users\Admin\AppData\Local\Temp\2c8316535580b835c1501608a0c54d27.exe
"C:\Users\Admin\AppData\Local\Temp\2c8316535580b835c1501608a0c54d27.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\2c8316535580b835c1501608a0c54d27.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:3412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-3-0x0000000005620000-0x0000000005621000-memory.dmp

Download